A security patch for the v1.4 line. No features, no behaviour changes — the fix without the features, which is what a patch on an older line is for.
Operators on v1.4.x should upgrade. Operators on v1.5.0 are unaffected and need do nothing: it was scanned alongside this and reported no findings.
Security
Clears every finding the scheduled re-scan reported against v1.4.1 — 19 HIGH, all with fixes available upstream that did not exist, or were not taken, when v1.4.1 was cut.
-
Go standard library (8 HIGH) — the
terrapod-querybinary baked into the api and runner images was built with Go 1.26.5. Now built with 1.26.6, clearing CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860 and CVE-2026-56862. -
Debian base packages (11 HIGH) — the
util-linuxfamily (bsdutils,libblkid1,liblastlog2-2,libmount1,libsmartcols1,libuuid1,login,mount,util-linux) for CVE-2026-53615, andlibpq5/postgresql-client-17for CVE-2026-6473.These were fixed upstream in Debian after v1.4.1 was built on 13 August; rebuilding the line is what brings them in. CI dates the images' package-refresh daily, so this is the expected shape of an ageing release rather than anything stuck — and it is exactly what the scheduled re-scan exists to surface.
-
pip's vendored bundle — refreshing the base image surfaced
setuptools70.3.0 (CVE-2025-47273) andmsgpack1.1.2 (GHSA-6v7p-g79w-8964) insidepip/_vendor. Not fixable by upgrading — the current pip vendors exactly those versions — so pip is now removed from the runtime images, which do not use it. The packages Terrapod actually imports were already clean.
Verified against the published image with the same scanner settings the release gate uses: zero HIGH or CRITICAL findings.
Upgrade notes
Drop-in. No migrations, no configuration changes, no API, Helm-value or wire-protocol changes. helm upgrade to chart 1.4.2.
Full Changelog: v1.4.1...v1.4.2